CVE-2026-41607: Apache Thrift: C++ JSON OOB read

Synopsis

An out-of-bounds read vulnerability exists in the C++ JSON parsing component of Apache Thrift before version 0.23.0. The flaw is reachable over the network without any authentication, meaning any client that can send JSON-encoded Thrift traffic to the affected service can trigger it. Successful exploitation lets an attacker read memory contents from the process and crash the service, resulting in sensitive data disclosure and a denial of service. A patched-image rebuild at version 0.23.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable parser is exposed over the network; an attacker must be able to send JSON-encoded Thrift traffic to the target service from a remote host.

• AuthenticationNot required

  No credentials or session token of any kind are needed to reach the vulnerable code path.

• Victim interactionNot required

  The attacker sends a malformed request directly to the service; no user action or social engineering is required.

• Attack complexityDetail

  The exploit is reliable and imposes no special preconditions such as race conditions or knowledge of memory layout; a crafted request is sufficient.

Blast Radius

• Reads process memory beyond the intended buffer, which may expose in-flight request data, heap contents, or internal state such as connection credentials or session material.
• Triggers an out-of-bounds read that crashes the affected service, causing a denial of service for all clients depending on that endpoint.
• Any secrets or tokens held in the process address space at the time of the read are at risk of disclosure to the attacker.